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(54) Log collecting/analyzing system with separated functions of collecting log information and 
analyzing the same 



(57) Disclosed log collecting/analyzing system is 
one in which log collection terminal device to be client 
terminal device collects logs and transmits the collected 
logs to log server via network. Then, the log server re- 
ceives the logs and stores to analyze the received logs. 
According to this configuration, it is possible to obtain 



useful information, such as the information about what- 
like play mode is popular in the case of game and so 
forth, or the information about what-like character is 
popular in the case of game of selecting character. 
Therefore, it is possible to make use of the result of log 
analysis for developing the game. 



FIG. 1 



CM 
< 

LO 

LO 
CD 
CM 



V 



LOG 

COLLECTION 

TERMINAL 

DEVICE 



LOG SERVER 



8 

, NETWORK, 




LOG 

STORAGE AREA] 




NETWORK 



LOG 

COLLECTION 

TERMINAL 

DEVICE 



LOG 

COLLECTION 

TERMINAL 

DEVICE 



LOG 

COLLECTION 

TERMINAL 

DEVICE 

<T 



m 



.LECTION 
NG COMPANY 



m 



.LECTION 
NG COMPANY 



LECTION 
NG COMPANY 



LECTION 
NG COMPANY 



-10 
-12 



CL 
LD 



Printed by Jouve, 75001 PARIS (FR) 



1 



EP 1 265 145 A2 



2 



Description 

[0001] This application is related to Japanese Patent 
Application No. 2001 -1 6781 5 filed on June 4, 2001 and 
No. 2002-8278 filed on January 17, 2002, based on 
which this application claims priority under the Paris 
Convention and the contents of which are incorporated 
herein by reference. 

BACKGROUND OF THE INVENTION 

1 . Field of the Invention 

[0002] The present invention relates to a log collect- 
ing/analyzing system, a method of log collection, a log 
collection program, a method of log analysis, a log anal- 
ysis program, a log collecting device, a log analyzing 
device, a log collection terminal device and a log server, 
which comprises separated functions of collecting log 
information and analyzing collected log information, and 
in which the log information is collected at client side 
and transmitted to server side, and the server side 
stores the log information to analyze. 

2. Description of the Related Art 

[0003] Conventional log collecting/analyzing system 
is used forthe purpose of observing something, in asys- 
tem for providing certain service. For instance, if the log 
collecting/analyzing system is applied to some on-line 
system, it is possible to ascertain how unfair access, 
fault of system or so forth occurred by analyzing log. In 
addition, if the log collecting/analyzing system is applied 
to WWW (World Wide Web) server, it is possible to 
record details that what-like client referred to, when, and 
what-like contents by analyzing log. And, as a result, it 
becomes possible to learn interest level of the user on 
the contents for example. 

[0004] However, in these conventional log collecting/ 
analyzing systems described-above, when contents for 
servicing are determined first, contents for observing 
are also fixed depending on the determined contents for 
servicing. And, as a result, collected log information re- 
quires specialized analysis system for log. Accordingly, 
an analyzing system for observation log at the on-line 
system is entirely different from an analyzing system for 
log of the WWW server for instance. 
[0005] In addition, as for method of log collection it- 
self, exclusive design and mounting are provided in eve- 
ry service system. For this reason, although basic func- 
tion of collecting log is only desired, subtle differences 
are generated on log collection items. As a result, ex- 
clusive design and mounting is required for every serv- 
ice as for the basic collecting system. 

SUMMARY OF THE INVENTION 

[0006] It is an object of the present invention to pro- 



vide a log collecting/analyzing system, a method for log 
collection, a log collection program, a method for log 
analysis, a log analysis program, a log collecting device, 
a log analyzing device, a log collection terminal device 
5 and a log server, all of which are capable of performing 
flexible log collection and analysis without being fixed 
log system as before. 

[0007] The log collecting/analyzing system according 
to the present invention is defined in independent claims 

10 1 and 35, the method for log collection according to the 
present invention is defined in independent claim 1 2, the 
method for log analyzing according to the present inven- 
tion is defined in independent claim 1 6, the log collecting 
device according to the present invention is defined in 

15 independent claim 1 9, the log analyzing device accord- 
ing to the present invention is defined in independent 
claim 21, a log collection terminal device according to 
the present invention is defined in independentclaim 23, 
and a log server according to the present invention is 

20 defined in independent claim 30. Preferred embodi- 
ments thereof are respectively defined in the respective 
following subclaims. The log collection computer pro- 
gram product according to the present invention is de- 
fined in claim 1 5 and the log analysis computer program 

25 product according to the present invention is defined in 
claim 18. 

[0008] A log collecting/analyzing system of the 
present invention has configuration in which a client ter- 
minal device collects log information and transmits col- 

30 lected log information to log server via network, and then 
the log server stores received log information to ana- 
lyze. In addition, the client terminal device is provided 
with a function for forming basic structure of log, a func- 
tion for generating desired log information from the basic 

35 structure of log and a function for transmitting generated 
log information to the log server. 

[0009] Namely, in the present invention, log collection 
function is separated into collection basic function and 
specific collection/analysis function, so that basic log 

40 collection function is capable of being used as common 
log collection function. According to this configuration, 
log collecting/analyzing system using the log collection 
function is not necessary to conduct mounting of its ba- 
sic function. In addition, it becomes possible to design 

45 and mount specific collection/analysis functions more 
easily by using this collection basic function, and, as a 
result, it becomes possible to collect effective logs. In 
addition, in the present invention, it is possible to estab- 
lish common log form as well as it is possible to establish 

50 common analysis function. 

[0010] In addition, log collection had an aspect in 
which utilization at on-line system is taken to be as- 
sumption, because utilization at the server side of serv- 
ice system was main utilization until now. However, in 

55 the present invention, log collection analysis function of 
log system is separated into function of log collection for 
client side and function of log analysis for server side 
and then client side conducts collection of log and server 
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side conducts analysis of log. According to this config- 
uration, client side is capable of collecting log in off-line 
condition. 

BRIEF DESCRIPTION OF THE DRAWINGS 

[001 1 ] The above and other features will be better un- 
derstood from the exemplary embodiments described 
below, taken together with the drawings, of which: 

FIG.1 is a block diagram illustrating the whole con- 
figuration of a log collecting/analyzing system; 
FIG. 2 is a block diagram illustrating configuration 
example of a log collection terminal device; 
FIG. 3 is a flowchart illustrating flow of log system 
processing at the log collection terminal device; 
FIG. 4 is a flowchart illustrating flow of initialization 
of a log system; 

FIG. 5 is a view illustrating one example of log user 
information; 

FIG. 6 is a flowchart illustrating login processing; 
FIG. 7 is a view illustrating display example of login 
screen; 

FIG. 8 is a view illustrating configuration of a log sys- 
tem at the side of the log collection terminal device 
for log collection; 

FIG. 9 is a view illustrating configuration of log ob- 
ject; 

FIG.1 0 is a view illustrating internal structure of 
management information of log; 
FIG. 11 is a chart of tree structure illustrating config- 
uration example of log data 1 ; 
FIG.1 2 is a view illustrating an example of being 
represented about log data by using XML (extensi- 
ble Markup Language); 

FIG.1 3 is a view illustrating an example of being 
represented about log object by using XML; 
FIG.1 4 is a view illustrating an example of API (Ap- 
plication Programming Interface) for forming log da- 
ta; 

FIG.1 5 is a view illustrating storing method of log 
object; 

FIG.1 6 is a block diagram illustrating configuration 
example of log server; 

FIG.1 7 is a view illustrating configuration of log sys- 
tem at the side of the log server; 
FIG.1 8 is a view illustrating configuration of man- 
agement database of log; 

FIG.1 9A illustrates configuration of management 
database of log: a view illustrating management ta- 
ble of log user; 

FIG.1 9B illustrates configuration of management 
database of log: a view illustrating management ta- 
ble of utilization of log application; 
FIG.1 9C illustrates configuration of management 
database of log: a view illustrating management ta- 
ble of log application; 

FIG. 20 is a view illustrating configuration of log stor- 



age database; 

FIG.21 A illustrates configuration of log storage da- 
tabase: a view illustrating log storage table for the 
user; 

5 FIG.21 B illustrates configuration of log storage da- 

tabase: a view illustrating log storage table for log 
application; 

FIG. 22 is a view illustrating configuration of man- 
agement database of log analyzed result; 

10 FIG. 23 illustrates configuration of management da- 
tabase of log analyzed result: a view illustrating 
management table of log analyzed result; 
FIG.24 is a view illustrating an example of storage 
table of log analyzed result; 

15 FIG.25 is a flowchart illustrating flow of log server 
system; 

FIG. 26 is a flowchart illustrating flow of reception of 
log; 

FIG.27 is a flowchart illustrating flow of log analysis; 
20 FIG.28 is a flowchart illustrating flow of acquisition 
of log analyzed result of utilizing company side of 
log collection service; 

FIG. 29 is a flowchart illustrating flow of acquisition 
of log analyzed result at log server side; and 
25 FIG.30 is a view illustrating another configuration of 
log system at log collection terminal device. 

DETAILED DESCRIPTION OF THE PREFERRED 
EMBODIMENTS 

30 

[0012] Preferred embodiments of the invention are 
described in detail below, with reference made to rele- 
vant accompanying drawings. Specific embodiment to 
which the present invention is applied will be described 

35 in detail referring to accompanying drawings below. 
[0013] The present embodiment provides entirely 
new example of log collecting/analyzing system in which 
client side collects log information and transmits the col- 
lected log information to server side, and the server side 

40 stores therein the transmitted log information to analyze. 
Namely, the present invention separates function of log 
collecting/analyzing system into two functions of collect- 
ing log and storing/analyzing the collected log in which 
the client side collects logs while the server side stores 

45 and analyzes the logs. 

[0014] In addition, function of the client side is to es- 
tablish basic structure of log and then generating de- 
sired log information from the basic structure of log. On 
the other hand, function of the log server is to execute 

50 storage-analysis of the received log information and 
then analyzing the log information in every application 
program. 

The Whole Configuration of Log Collecting/Analyzing 
55 System 

[0015] In the fist place, rough flow of log collection, 
analysis and provision in the log collecting/analyzing 
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system will be described. 

[0016] FIG.1 illustrates the whole configuration of the 
log collecting/analyzing system. Log collection terminal 
device devices 1 to 4 of being client terminal device de- 
vices to which client side software and client side hard- 
ware for collecting log are provided are connected to 
network 5 respectively. It should be noted that the log 
collection terminal device is capable of being added to 
increase without limiting the number of piece by sharing 
the network 5. 

[0017] In the log collecting/analyzing system illustrat- 
ed in FIG.1 , the log collection terminal device devices 1 
to 4 collect logs and then store therein logs temporarily. 
The log collection terminal device devices 1 to 4 transmit 
log information that is collected and stored therein tem- 
porarily by the log collection terminal device devices 1 
to 4 toward log server 7 via the network 5. The log server 
7 is provided with log storage area 6 for storing therein 
received log information. Then, the log server 7 stores 
the log information transmitted from the log collection 
terminal device devices 1 to 4 in the log storage area 6. 
In addition, the log server 7 takes out the log information 
stored in the log storage area 6 and then executes anal- 
ysis processing of the log information, before storing the 
analyzed result in the log storage area 6 again. 
[0018] It should be noted that respective procedures 
for analysis processing executed by the log server 7 are 
defined by log collection service utilizing companies 9 
to 12. In addition, design and mounting are established 
so that collection program when conducting log collec- 
tion and analysis processing correspond to log collec- 
tion side and log analysis side respectively. 
[001 9] Here, consideration is made in connection with 
the case that the log collection service utilizing compa- 
nies 9 to 12 require analyzed result of log. At this time, 
to begin with, the log collection service utilizing compa- 
nies 9 to 12 input acquisition requirement of the ana- 
lyzed result to the log server 7 via the network 8. The 
log server 7 which has received the acquisition require- 
ment from the log collection service utilizing companies 
9 to 12 authenticates the log collection service utilizing 
companies 9 to 12 connected to the network and then 
the log server 7 adopts or rejects companies 9 to 12 on 
the basis of authentication result, after that, the log serv- 
er 7 transmits log analyzed result to the authenticated 
companies. It should be noted that a plurality of log col- 
lection service utilizing companies are connectable to 
the log server 7 via the network 8. Then, the log server 
7 is capable of transmitting log analyzed result toward 
any of the log collection service utilizing companies 9 to 
12 that are authenticated to be connected to the log 
server 7 via the network 8. 

Log collection terminal device (Client Side) 

Configuration of Log collection terminal device 

[0020] Next, following description is one in which con- 



figuration of the log collection terminal device devices 1 
to 4 will be explained. FIG. 2 illustrates internal configu- 
ration of one log collection terminal device. The log col- 
lection terminal device comprises an image/sound con- 
5 trol unit 1 3, CPU (central calculation processing unit) 1 4, 
a communication control unit 15, media control unit 16, 
RAM 17, external memory control unit 18, input control 
unit 19, HDD (magnetic recording medium) 20, as prin- 
cipal configuration elements, in which these respective 
10 elements are connected with each other via bus. 

[0021] The image/sound control unit 13 controls im- 
age output for monitor unit that is not illustrated and 
voice output for speaker and so forth or input from video 
camera and microphone. The CPU 14 controls total op- 
15 eration of the log collection terminal device. The com- 
munication control unit 15 that is connected to the net- 
works illustrated in FIG.1 controls communication of be- 
ing executed between the communication control unit 
15 and the networks. The media control unit 16 controls 
20 media drive which is not illustrated, in that the media 
control unit 16 inputs therein signals from external re- 
cording media such as CD-ROM and/or DVD-ROM and 
so forth equipped with the media drive or the media con- 
trol unit 16 causes the external recording media to write 
25 signals. 

[0022] The H DD 20 records various kinds of programs 
containing program for realizing log collection process- 
ing of the present embodiment and/or various kind of 
data. The RAM 1 7 stores therein program read out from 
30 the HDD 20 and/or data utilized on the occasion of ex- 
ecution of various kinds of processing. The external 
memory control unit 18 which is connected to nonvola- 
tile memory 21 existing at external part of the log collec- 
tion terminal device and then the external memory unit 
35 18 controls transmission/reception of the data as well 
as write/read of the data between the external memory 
control unit and the memory 21. The input control unit 
19 controls input units to be user interface such as key- 
board, mouse, and so forth that are not illustrated. 

40 

Flow of Processing at the Time of Log System Utilization 
according to Log collection terminal device 

[0023] Next, flow of processing (principally, process- 
es jng of application part according to the present inven- 
tion) at the log collection terminal device will be ex- 
plained using FIG. 3. It should be noted that processing 
illustrated in FIG.3 is one that is mainly achieved by 
function of the CPU mounted on the log collection ter- 
50 minal device. First, as processing of STEP S1, the log 
collection terminal device provides initialization of log 
collecting/analyzing system illustrated FIG.1 in order to 
permit utilization of the log collecting/analyzing system. 
In this initialization, judgments are made in which the 
55 log collection terminal device ascertains log user in or- 
der that the log collection terminal device uses the log 
collecting/analyzing system illustrated in FIG.1 , and the 
log collection terminal device judges whetherthe log col- 
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lection terminal device is capable of using the log col- 
lecting/analyzing system illustrated in FIG.1, and so 
forth. When completing the processing, in the log col- 
lection terminal device, initialization of application is ex- 
ecuted as processing of STEP S2. 
[0024] When completing the initialization of the appli- 
cation, the log collection terminal device provides main 
processing (application main processing) of the appli- 
cation as processing of STEP S3. It should be noted that 
the application main processing will be described later. 
Then, the log collection terminal device, when complet- 
ing the application main processing, executes process- 
ing in order to terminate utilization of the log collecting/ 
analyzing system illustrated in FIG.1 as processing of 
STEP S4. According to this termination processing, the 
log collection terminal device stores log information 
maintained in the RAM 1 7 for the sake of the log collect- 
ing/analyzing system into the HDD 20 and so forth, fur- 
ther the log collection terminal device conducts release 
of resources that are used for the log collecting/analyz- 
ing system. After that, the log collection terminal device 
conducts termination processing of the application of 
the present embodiment as processing of STEP S5. Af- 
ter that, the log collection terminal devices 1 to 4 become 
condition in which the log collection terminal device de- 
vices 1 to 4 are capable of being terminated. 

Initialization of Log collection terminal device for the 
sake of Utilization of Log Collecting/Analyzing System 

[0025] Next, following description is one in which de- 
tail of processing for the sake of utilization of the log col- 
lecting/analyzing system of being conducted in STEP 
S1 of FIG. 3 is explained. FIG.4 illustrates a flowchart for 
initialization processing of the log collection terminal de- 
vice for the sake of utilization of the log collecting/ana- 
lyzing system. First, the log collection terminal device 
conducts login processing of the log user as processing 
of STEP S6. This login processing is necessary 
processing for identifying the user who uses the log col- 
lecting/analyzing system, and the processing informs 
the information concerning the user thus the user is 
grasped. 

[0026] In ascertainment processing of STEP S6, 
when the user is not registered as a log user, log user 
registration processing is conducted in processing of 
STEP S7. In this registration, the log collection analysis 
terminal device ascertains whether double registration 
is conducted in this registration, or whether the user is 
unfair user, in such away as to compare information reg- 
istered beforehand with information input by the log user 
registration, and so forth. Then, in processing of STEP 
S8, when succeeding user registration, the log collec- 
tion terminal device continues log system initialization. 
In this processing of STEP S8, user registration is not 
made by factor of some kind, the log collection terminal 
device interrupts log system initialization and then the 
log collection terminal device executes log system no 



use condition setting at processing of STEP S12, there- 
after, the log collection terminal device concludes the 
log system initialization. 

[0027] On the other hand, in processing of STEP S8, 
5 when registration ascertainment as log user is succeed- 
ed, the log collection terminal device inputs therein log 
user information stored in, for instance, the HDD 20 and/ 
or the nonvolatile memory 21 as processing of STEP 
S9, further, the log collection terminal device inputs 
10 therein log system utilization title information as 
processing of STEP S10. 

[0028] Then, the log collection terminal device ascer- 
tains whether the log system can be utilized as process- 
ing of STEP S1 1 . It should be noted that this ascertain- 

15 ment is conducted to control period of using the log sys- 
tem. For instance, in cases where certain log service is 
established so as to provide service only one month, if, 
for instance, service period of the log collecting/analyz- 
ing system is concluded, it becomes not possible to 

20 transmit log to the log server 7, therefore, the log collec- 
tion terminal device ascertains whether the log collect- 
ing/analyzing system is capable of being used in order 
to forestall occurrence of such condition. 
[0029] When judgment is one in which the log collect- 

25 ing/analyzing system can not be utilized in the judgment 
of STEP S1 1 , operation of the log collection terminal de- 
vice proceeds to processing of STEP S1 2, and then set- 
ting the log system into use prohibition condition. This 
use prohibition condition is that the log collection termi- 

30 nal device overrides records of log in the log collecting/ 
analyzing system, and function of transmission of log for 
the log server 7, and so forth. Thus, when the log col- 
lecting/analyzing system is set to the use prohibition 
condition, an application that employs the log collecting/ 

35 analyzing system is capable of executing processing in 
the same way as that of normal function regardless of 
whether the log collecting/analyzing system is effective 
or ineffective, however, specific processing of recording 
of logs and/or transmitting of logs are not executed. 

40 Namely, the log collection terminal device realizes con- 
trol of the use prohibition condition in such a way as to 
internally control whether processing of recording log 
and transmitting log is reflected. 
[0030] On the other hand, when providing judgment 

45 that the log collecting/analyzing system is capable of be- 
ing used at STEP S1 1 , the log collection terminal device 
executes transmission processing of logs that are not 
transmitted yet as processing of STEP S13. 
[0031] The present invention is characterized in that 

50 it is possible to realize function of collecting log in off- 
line environment. Processing of STEP S13 relates to the 
function of collecting in off-line environment. Namely, 
when the log collection terminal device is always con- 
nected to the network 5, it is possible to process surely 

55 transmission of the log to the log server 7, while when 
the network 5 is interrupted, or it is not possible to trans- 
mit log information for the log server 7 side caused by 
obstacle of some kind, the log collection terminal device 
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stores log information temporarily, and then, the log col- 
lection terminal device transmits log again when the net- 
work 5 or the log server 7 is restored to normal condition. 
Processing of STEP S13 is one in which retransmission 
function of the log is realized. 

Record of Log User Information 

[0032] Next, as for information registered as log user 
information and registered position thereof are ex- 
plained. 

[0033] If position of recording log user information is 
in nonvolatile recording media on the log collection ter- 
minal device, whichever position is recorded position, 
the position is permitted. For instance, it is possible to 
record the log user information on the nonvolatile mem- 
ory 21, HDD 20 illustrated in FIG. 2, or on writable media 
controlled by the media control unit 16. However, when 
convenience and/or confidentiality are taken into con- 
sideration, recording on the nonvolatile memory 21 is 
effective because recording on nonvolatile memory is 
capable of being easily utilized to login processing at 
another log collection terminal device. It is assumed in 
the present embodiment that the log user information is 
recorded on the nonvolatile memory 21. In the present 
embodiment, each user is assigned a nonvolatile mem- 
ory 21 and each user uses the nonvolatile memory 21, 
whereby the log collection terminal device is capable of 
identifying respective log users. FIG. 5 illustrates one ex- 
ample of log user information. The log user information 
includes, for instance, name 23, address 24, telephone 
number 25, age 26, log user ID 27, and password 28. 
The password 28 is one that is established at the time 
of log user registration, in which input of the password 
28 is desired when the log user performing login, then, 
it becomes possible to judge as identical person when 
the password 28 is correct. It is assumed in the present 
embodiment that the nonvolatile memory 21 of being re- 
corded the log user information is used as authentica- 
tion card. Hereinafter, the nonvolatile memory 21 is 
called as authentication card 21. 

Login Processing 

[0034] Next, as for login processing in STEP S6 illus- 
trated in FIG. 4 is explained. FIG. 6 is one in which flow- 
chart of this login processing is illustrated. First, as 
processing of STEP S14, the log collection terminal de- 
vice allows a monitor unit that is not illustrated to display 
a login screen 29 as illustrated in FIG. 7 for example. The 
log collection terminal device allows login screen 29 to 
display user ID display column 30 and password input 
column 31. The user ID display column 30 displays ID 
that is recorded in the authentication card 21 (nonvola- 
tile memory 21). The password input column 31 is one 
to which the log user inputs the password 28. 
[0035] In addition, the log collection terminal device 
ascertains whether the log user has the authentication 



card in STEP S18 at the same time of processing of 
STEP S14. Namely, the log collection terminal device 
judges whether the log user has the authentication card 
21 depending on detection whether the authentication 

5 card 21 is connected to the external memory control unit 
18, and whether the log user information is recorded 
within the authentication card 21. 
[0036] In STEP S15, when the log collection terminal 
device judges that the log user does not have the au- 

10 thentication card 21, the log collection terminal device 
regard the log user as new one, and then allowing 
processing of this state to move toward new registration 
processing of STEP S16. While, when the log collection 
terminal device judges that the log user has the authen- 

15 tication card 21 at STEP S15, the log collection terminal 
device judges that the log user have been already reg- 
istered as the log user, and then the log collection ter- 
minal device allows the processing of this state to move 
toward processing of STEP S17. When proceeding to 

20 processing of STEP S17, the log collection terminal de- 
vice inputs therein log user ID 27 from the authentication 
card 21 and then allowing the log user ID 27 to be dis- 
played on the user ID display column 30. 
[0037] Next, the log collection terminal device, in 

25 STEP S1 8, takes in password 28 input from the log user, 
further the log collection terminal device, in STEP S19, 
conducts verification of the password 28. It should be 
noted that the password 28 is input via input unit such 
as keyboard and so forth. When verification result of the 

30 password 28 in STEP S19 is that password input from 
the log user does not agree with the registered pass- 
word, the log collection terminal device allows the 
processing of this state to move toward processing of 
STEP S20, and then conducting login failure process- 
es jng. In this login failure processing, it is possible to urge 
input of the password 28 again or it is possible to exe- 
cute processing of terminating it as login failure as it is. 
It should be noted that, it is assumed in the present em- 
bodiment that login is terminated as login failure 

40 processing of STEP S20. 

[0038] When verification result of the password 28 in 
STEP S19 is that password input from the log user 
agrees with the registered password, the log collection 
terminal device judges that user authentication is com- 

45 pleted, and then executing login success processing as 
processing of STEP S21, after that, the log collection 
terminal device terminates the login processing. It 
should be noted that in the login success processing in 
STEP S21, it could be considered that, for instance, 

50 screen display for indicating success in login, and so 
forth. 

System Configuration of Log collection terminal device 

55 [0039] FIG. 8 illustrates connection of programs for re- 
alizing log collection and log transmission in the log col- 
lection terminal device. In the present embodiment, 
there is provided a login interface provided with function 
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for forming basic structure of the log and function for 
generating desired log information from the basic struc- 
ture of the log which the login interface hierarchically 
constructs log, and then transmitting hierarchically con- 
structed log information to the log server 7, or independ- 
ently managing the log information in every application 
program. 

[0040] Program illustrated in FIG. 8 comprises an ap- 
plication 32 for utilizing the log system, a log system ba- 
sic function processing unit 33 for providing basic func- 
tion of the log collecting/analyzing system and an oper- 
ating system 39 for operating the log collecting/analyz- 
ing system, in which upper and lower side relationship 
illustrated in FIG. 8 means that function positioned at up- 
per order utilizes function of low order. 
[0041] The log system basic function processing unit 
33 is separated into some processing units. Login inter- 
face management unit 34 manages login interface 38. 
The login interface 38 which is independently defined 
by the log collection service utilizing companies 9 to 12 
for utilizing collected log information executes process- 
ing for outputting log that is specialized in accordance 
with respective log service. When the application 32 re- 
quires the login interface 38, the login interface manage- 
ment unit 34 initializes desired login interface 38 to pro- 
vide. 

[0042] On the inside of these programs, the log is 
managed in every unit of log object, and log object 
processing unit 35 is a unit for controlling function of the 
log object as being basics of the log. Log object trans- 
mission unit 36 is a unit for controlling processing of 
transmitting log information to the log server 7. Log ob- 
ject management unit 37 is a unit for managing log itself 
such as storage area of log object, elimination process- 
ing thereof and so forth. For instance, when executing 
storage of logs, the log object management unit 37 
specifies appropriate position for the storage. Also, on 
the occasion of elimination of unnecessary log, the log 
object management unit 37 controls the elimination. 

Configuration of Log Object 

[0043] FIG. 9 illustrates configuration of log object 40. 
Log object 40 is composed of log management informa- 
tion 41 and log data 1 to 4 (42 to 45). The log manage- 
ment information 41 is one in which information for in- 
forming background of the log object 40 is recorded. The 
log data 1 to 4 (42 to 45) are ones in which specific log 
information generated by the login interface 38 is re- 
corded. In addition, the log object 40 is capable of in- 
cluding a plurality of log data. It should be noted that 
FIG. 9 illustrates one example thereof. 
[0044] FIG. 10 illustrates internal configuration of the 
log management information 41. The log management 
information 41 is composed of log application ID 46 and 
log user ID 47. The log application ID 46 is identification 
information that is utilized in order to specify application 
of controlling to use the log collecting/analyzing system. 



In addition, the log user ID 47 indicates identification in- 
formation of being utilized in order to indicate that the 
log belongs to which user. 

[0045] Next, as for configuration of the log data 1 to 4 
5 (42 to 45), which is explained using example of FIG.1 1 . 
FIG. 11 illustrates configuration of the log data 1 (42), 
and such log data 1 (42) is divided into two of node and 
element with tree structure. The node is capable of in- 
cluding nodes or elements. It should be noted that the 
10 node can not be utilized as terminal device. While, the 
element is capable of being utilized as terminal device 
and capable of including arbitrary data. The node 48 is 
root node, and the front of log data refers to front node 
of the root node 48. The node 49 is one for including 
15 element 50 positioned at low order. 

[0046] The log data 1 to 4 (42 to 45) are capable of 
adopting arbitrary log structure due to management of 
such tree structure. Here, in the present embodiment, 
XML (extensible Markup Language) is utilized as spec- 
20 ification for defining this tree structure. FIG.1 2 illustrates 
one example thereof. This FIG.1 2 illustrates example of 
being recorded selected play mode and the number of 
utilization of the play mode in a certain application such 
as video game and so forth. Tag <play Date> in FIG. 12 
25 indicates data when the user takes the log, and tag 
<mode> records play mode name that is used in this 
case (indicated by tag <name>) and the number of use 
thereof (indicated by tag <selected Times>). This exam- 
ple indicates that record is one in which Practice Mode 
30 is used three times at 2000, 1 2, 24. 

[0047] When extracting data from this log data, it is 
possible to retrieve desired data by following the tag. 
Here, FIG. 13 illustrates example of the case in which 
log object illustrated in FIG. 9 is expressed as XML. In 
35 an example of FIG.1 3, <info> tag describes both log ap- 
plication ID (hereinafter referred to as log appli. ID 46) 
for indicating log application program (hereinafter re- 
ferred to as log appli.) that generates the log object and 
log user ID 47 indicating user to become object of the 
40 log. 

[0048] In addition, the log related to the login interface 
is described in <DATA> tag 52. Namely, the <DATA> tag 
52 as being example illustrated in FIG. 1 3 describes that 
this tag is one which is generated by login interface in- 
45 dicated by interface ID1, further, on the inside of the 
<DATA> tag 52, which describes the log itself constitut- 
ed by login interface indicated by the interface ID1. The 
shape of the <DATA> tag 52 at this time becomes one 
illustrated in FIG. 1 1 . Accordingly, if following these tags, 
50 it becomes possible to retrieve desired data. It should 
be noted that these ID are utilized in orderto homologize 
analysis interface used on the occasion that analysis of 
the log is executed onto the log at the log server 7 later. 

55 Relationship between Login interface and Service 

[0049] Now, tree structure of the log illustrated in FIG. 
11 is also capable of being output directly from respec- 
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tive applications, however, when preparing such config- 
uration in every application, there may be problems that 
programs for forming tree structure are redundant, in ad- 
dition, since pre-arrangements for recording log is large, 
development efficiency decreases. In the present em- 5 
bodiment, since development of program for forming 
tree structure in every respective application causes 
bad efficiency, therefore, the present embodiment en- 
hances development efficiency of the application by pro- 
viding program for forming tree structure as library. 10 
[0050] I n order to solve the above subject, the present 
invention separates functions such as preparation, stor- 
age and so forth of basic structures of the log as basic 
function, further designing and mounting specific re- 
corded part of the log at the application side that utilizes 15 
its basic function as login interface, whereby the present 
invention realizes effective log collecting/analyzing sys- 
tem capable of flexibly coping with various kind of uses. 
[0051] Namely, in the present embodiment, the login 
interface 38 illustrated in FIG. 8 provides above-de- 20 
scribed log data 1 to 4. The login interface 38 described 
in the present embodiment is a program that is designed 
and mounted in order to collect and record logs, in which 
the login interface 38 functions as API (Application Pro- 
gramming Interface) between the application 32 illus- 25 
trated in FIG. 8 and the log system basic function 
processing unit 33. This library with the login interface 
38 mounted allows log basic library that is one for pre- 
paring basic tree structure on the inside thereof to ac- 
cess, in which the log basic library outputs the result and 30 
receives in accordance with determined format, in addi- 
tion, the log basic library hierarchically constructs log 
and then designing and mounting specialized log for the 
application program. 

[0052] Here, the login interface 38 is specifically de- 35 
signed depending on necessary log contents, and one 
example thereof is illustrated in FIG. 14. In the login in- 
terface 38 illustrated in FIG. 14, API 53 is one in which 
date of use is recorded. At the side of the application 32, 
it becomes possible to generate <Play Date> tag by ac- 40 
cessing this API 53. In addition, the application 32 be- 
comes possible to prepare <mode> tag and the follow- 
ing structure bodies by accessing the API 53. It should 
be noted that, as for this API 54, device is slightly added 
in this mounting in that when mode with the same name 45 
is used, the number of times of use is added to record 
by 1 . Thus, according to mounting of the login interface 
38 of the present embodiment, the side of the applica- 
tion 32 can manage data desired to record, and also the 
side of the login interface 38 is capable of managing the 50 
data desired to record, thus any of them is capable of 
recording necessary data. 

[0053] Next, as for storage method of above de- 
scribed log object including logs will be described using 
FIG. 15. Log objects are recorded in nonvolatile storage 55 
area such as HDD 20, flash memory and so forth. In the 
present embodiment, log objects are recorded in au- 
thentication card 21. In addition, the log object is man- 



aged in every application unit in which the log object is 
used. Namely, the log object is managed on its storage 
area in every application with shape of title 1, title 2, ■■■ 
illustrated in FIG. 15, in which the logs are registered to 
those respective areas. For instance, log storage area 
55 illustrated in FIG. 15 is managed for the sake of ap- 
plication of title 1, and log 56 is registered to the area 
55 in that the application utilizes the log 56. 
[0054] The log object is stored with shape of structure 
as illustrated in right side of FIG.1 5. Namely, the log ob- 
ject is constituted by a transmission flag 57, a log object 
size 58 and a log object 59. The transmission flag 57 is 
one that records conditions when transmitting logs to the 
log server 7, thus the transmission flag 57 has three con- 
ditions of, for instance, un-transmitted, finished trans- 
mission and in transmission. The un-transmitted means 
that the log is not transmitted to the log server yet. The 
finished transmission means that the log is already 
transmitted to the log server 7. The in transmission 
means that transmission of the log is not completed to 
the log server 7 caused by interruption of the transmis- 
sion by cause of some kind in the last time transmission 
of the log. When transmitting the logs, the log of un- 
transmitted or the log in transmission is transmitted to 
the log server 7. In addition, the log storage area 55 in- 
creases to accumulate the logs, however, about the fin- 
ished transmission logs, it is possible to remove the logs 
of being finished transmission. For this reason, memory 
areas such as HDD 20, flash memory and so forth are 
not pressured. 

Termination Processing of Log System 

[0055] Next, as for termination processing at the side 
of log collection terminal device will be explained. In the 
side of the log collection terminal device, when applica- 
tion is made to terminate, first, it is necessary to termi- 
nate utilization of the log collecting/analyzing system. 
This processing is necessary one in order that the log 
is recorded without contradiction. For this reason, the 
log collection terminal device allows utilization termina- 
tion processing of the log collecting/analyzing system to 
execute before termination processing (processing of 
STEP S5) of the application as processing of STEP S4 
illustrated in FIG. 3. Specifically, the log collection termi- 
nal device forcibly stores therein the log object in use, 
and/or executes use termination processing of log stor- 
age area, and so forth in safety. The log collection ter- 
minal device executes termination processing of the log 
application itself at STEP S5 after termination of these 
processing, and thus terminating operation of the log 
collection terminal device itself. 

Log Server (Server Side) 

Configuration of Log Server 

[0056] Next, as for configuration of log server 7 side 
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will be explained. The log server 7, as illustrated in FIG. 
16, is composed of an image/sound control unit 60, a 
CPU 61, a communication control unit 62, a media con- 
trol unit 63, a RAM 64, an input control unit 65 and a 
HDD 66 as principal configuration elements, in which 
these elements are connected via bus 67. 
[0057] The image/sound control unit 60 controls im- 
age output for monitor unit that is not illustrated and 
voice output for speaker and so forth or controls inputs 
from video camera and microphone. The CPU 61 takes 
charge of control for program on the log server 7 and/or 
control of equipment connected by the use of bus 67. 
The communication control unit 62 is connected to the 
networks 5, 8 illustrated in FIG.1 and then the commu- 
nication control unit 62 controls communication execut- 
ed between the networks 5 and 8 and another part, and 
being utilized reception of the logs and so forth. The me- 
dia control unit 63 controls media drive that is not illus- 
trated, and then the media control unit 63 inputs therein 
signals from external mediasuch as CD-ROM, DVD and 
so forth equipped with the media drive, in addition, the 
media control unit 63 allows signal writing and so forth 
to be executed to external media such as CD-RW and 
so forth. The RAM 64 is a unit for storing program, data 
and so forth for operating at the log server 7. The input 
control unit 65 controls input unit to be user interface 
such as keyboard, mouse that are not illustrated at the 
log server 7. The H DD 66 is large capacity storage area 
for recording log information managed at the log server 
7 and/or for recording analyzed result and so forth. 

System Configuration of Log Server 

[0058] Next, FIG.1 7 illustrates outline configuration of 
program for realizing reception-analysis of logs in the 
log server 7. In the present embodiment, the log server 
independently manages log information received from 
the log collection terminal device for every individual ap- 
plication program, and then the log server pulls out nec- 
essary information from the log information to analyze, 
after that, the log server stores analyzed result in de- 
sired form. 

[0059] Program illustrated in FIG.1 7 is mainly provid- 
ed with an operating system 74, a log server function 
processing unit 68 and a log analysis interface 70 and 
relationship between upper and lower in the drawing 
means that upper rank section utilizes function of lower 
rank section. The log server function processing unit 68 
is composed of a log analysis interface management 
unit 69, a log object analysis unit 71 , a log object recep- 
tion unit 72 and a log analyzed result management unit 
73. 

[0060] The log analysis interface management unit 69 
manages log analysis interface 70. Namely, the log 
server 7 is capable of pulling out the log analysis inter- 
face 70 necessary for analysis in such a way as to go 
through the log analysis interface management unit 69. 
The log analysis interface 70 is an interface for analyz- 



ing log information received from the log collection ter- 
minal device. Such log analysis interface 70 is designed 
and mounted with form corresponding to the login inter- 
face 38 used at the system of log collection terminal de- 
5 vice side. 

[0061] The log object analysis unit 71 analyzes logs 
received by the log server 7. The log object reception 
unit 72 is one that controls function for receiving logs 
transmitted from the log collection terminal device. The 
10 log analyzed result management unit 73 stores therein 
result of analysis analyzed in the log object analysis unit 
71 , in addition, the log analyzed result management unit 
73 provides result of analysis to the log collection serv- 
ice utilizing companies 9 to 12. 

15 

Log Management Database 

[0062] In addition, the above-described log server 7 
receives the above-described log and then the log serv- 

20 er 7 allows database to be prepared in order to store 
and manage the result of analysis analyzed by the log 
server7. In the present embodiment, a log management 
database, a log storage database and a log analyzed 
result management database are prepared as data- 

25 base. FIG.1 8 to FIG. 23 illustrate configurations of these 
databases. It should be noted that these databases are 
managed on the log storage area illustrated in FIG.1. 
[0063] FIG.1 8 illustrates outline configuration of log 
management database to be one of these databases. 

30 The log management database is composed of a log 
user management table 76, a utilization log application 
management table 77 and a log application manage- 
ment table 78. 

[0064] The log user management table 76 manages 

35 user information of being subjected to log service. This 
table contents are constituted from log user ID, name, 
age, address, telephone number, log storage table 
name and utilization log application management table 
name, as illustrated in the log user management table 

40 76 of FIG.1 9A. Since such name, age, address, tele- 
phone number and so forth are items of forming as one 
example, when detailed information as personal infor- 
mation is desired, it is possible to cope with such case 
by increasing items if necessary. The log storage table 

45 name is one in which when the log server 7 receives the 
log, storage position of the log is specified within the log 
storage table name. The log is stored and managed in 
every log user. The log management information of the 
log object illustrated in FIG. 10 is utilized here. The log 

50 appli. ID described in the log object is used in order to 
classify the log application, in addition, the log user ID 
is used in order to classify the log users. 
[0065] The utilization log application management ta- 
ble name illustrated in FIG.1 9B specifies utilization log 

55 application management table 77 in order to manage 
log application of being used by the user. This utilization 
log application management table 77 is constituted by 
the log appli. ID and the final log reception the date and 
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time as illustrated in FIG.19B. The utilization log appli- 
cation management table 77 is prepared in every log 
user, and the utilization log application management ta- 
ble 77 manages that the log user utilizes from which log 
application. Accordingly, it becomes possible to imme- 
diately know that the log user utilizes which log applica- 
tion by referring to this table. In addition, log user infor- 
mation on the log user management table 76 is prepared 
by new log user registration. For instance, new log user 
registration processing in STEP S16 illustrated in FIG. 
6 provides the log user information. 
[0066] The log application management table 78 
manages log application of executing log service. The 
configuration of the log application management table 
78 is illustrated in FIG.1 9C, and the log application man- 
agement table 78 is composed of log appli. ID, licensee 
name, authentication data, log storage table name, the 
number of analysis table, log analyzed result manage- 
ment table name and flag in service. The log appli. ID is 
number numbered uniquely to application that uses the 
log collecting/analyzing system. The licensee name in- 
dicates a person who prepares the log application or 
company name thereof. The authentication data is uti- 
lized in order to ascertain other person who provides the 
log on the occasion of providing the log. The log storage 
table name indicates log storage table for log application 
in order to manage log registered in log application. The 
number of analysis table is one which indicates the 
number of existing how many analyzed result table in 
the result of analyzing by log application. The log ana- 
lyzed result management table name manages table 
that stores log analyzed result, and the log analyzed re- 
sult management table name is generated in every log 
application. The flag in service is one which controls 
whether the log application is capable of being utilized. 
The flag is utilized in order to indicate service conditions 
that, for instance, service is already terminated. 

Log Storage Database 

[0067] FIG. 20 illustrates outline configuration of log 
storage database 79. The log storage database 79, as 
illustrated in FIG. 20, is composed of a log storage table 
for the user 80 and a log storage table for the log appli- 
cation 81. The log storage table for the user 80, when 
the log user transmits log to the log server 7, is a position 
in which the log is stored first. Configuration of the log 
storage table for the user 80, as illustrated in FIG. 21 A, 
includes a log reception ID, a log reception the date and 
time, a utilization log application ID and logs. The log 
reception ID is number numbered uniquely in every log 
reception. The log reception the date and time is one in 
which the date and time when the log is received is re- 
corded. The utilization log application ID indicates that 
recorded log is utilized what log application. Further, the 
log object itself is recorded in the log shown in FIG. 21 A. 
[0068] The log storage table for log application 81 is 
one that manages log registered in the log application. 



The log storage table for log application 81 is utilized for 
analysis of the log. Analysis of the log is executed in 
every log application, however, determination whether 
which log is analyzed is made while referring to this log 

5 storage table for log application 81. The log storage ta- 
ble for log application 81 is constituted by log reception 
ID, log reception the date and time and log user ID as 
illustrated in FIG. 21 B. In analysis of the log, it is possible 
to specify which log of the log storage table for user 80 

10 according to the log reception ID and the log user ID to 
analyze the specified log. 

Log Analyzed result Management Database 

15 [0069] FIG. 22 illustrates outline configuration of log 
analyzed result management database. The log ana- 
lyzed result management database 82 is composed of 
log analyzed result management table 83 and analyzed 
result storage table by login interface 84. The log ana- 
20 lyzed result management table 83, as illustrated in FIG. 
23, is composed of log analysis interface ID and log an- 
alyzed result storage table name. The log analysis in- 
terface ID indicates interface for analyzing the log and 
corresponds to ID of the login interface 38 used in the 
25 side of log collection terminal device. The log analysis 
interface ID is one to which function for accessing nec- 
essary information is mounted, in which necessary in- 
formation is accessed to be pulled up from the log that 
is generated by login interface at the side of the log col- 
30 lection terminal devices 1 to 4. 

[0070] Here, specifically, operation of the log analysis 
interface will be explained by using example of log data 
illustrated in FIG.1 2 and example of the login interface 
illustrated in FIG.1 4. In the example, the example de- 
35 scribes the case of analysis of the log such that "Date 
when play is performed", "which mode is selected, and 
the mode is selected how many times". The log analysis 
interface extracts first "date of performing play" and "the 
number of selection of mode" from the log object and 
40 then storing the analyzed result in a table illustrated in 
FIG. 24. This table is constituted from log user ID, date 
of play and four play modes (practice mode, tournament 
mode, season mode, customize mode). In play date, the 
play date illustrated in FIG.1 2 is described. In addition, 
45 in respective four play modes, the number of times of 
playing is described. Further, in log user ID, log user ID 
of transmitting the log is described. The log analysis in- 
terface 70 executes extraction of data, conversion and 
record processing in order to record such analyzed re- 
50 suit on the database. 

Flow of Processing for Log Server System 

[0071] Next, entire flow in log server system will be 
55 described referring to FIG.25. It should be noted that 
processing illustrated in FIG.25 is one that is mainly con- 
ducted by CPU 61 of the log server 7. Firstly, as process- 
ing of STEP S22, initialization of the log server system 
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is executed. In this initialization, necessary initialization 
of database manager is executed in order that the log 
server system uses the database and then necessary 
initialization of computer resources for the log server 7 
that requires the above initialization of database man- 
ager. Next, in processing of STEP S23, the log server 
system becomes log reception condition of receiving 
signal (log information) transmitted from the log collec- 
tion terminal device. Here, stand-by condition continues 
until log reception is completed. 

[0072] Next, in processing of STEP S23, when the log 
server receives the logs, in processing of STEP S24, 
the log server 7 executes analysis processing of re- 
ceived log. Analysis processing of log in STEP S24 ex- 
ecutes respective appropriate analyses according to log 
analysis interface 70 that specifies contents of the logs. 
Further, when terminating analysis of the logs, the log 
server system executes termination check in processing 
of STEP S25. Generally, since the log server system 
continues operation, the log server system returns to 
processing of STEP S23 to come into log reception con- 
dition. Here, when being issued termination order, the 
log server system judges as being log server system ter- 
mination, then processing proceeding to STEP S26 to 
execute termination processing of the log server system 
here. Termination of the log server system indicates ter- 
mination of computer resources and database manager 
that the log server system uses. 
[0073] It should be noted that flow of processing of the 
log server system illustrated in FIG.25 is, to the last, one 
of realized example, therefore, the flow of processing 
does not limit processing of log server system. 

Flow of Log Reception 

[0074] Next, flow in which log server receives log will 
be explained using flowchart of FIG.26. Firstly, in 
processing of STEP S27, ascertainment is made wheth- 
er the log server receives logs. When the log server 7 
does not receive logs, processing returns to STEP S27 
itself, this repeated processing continues until log is re- 
ceived. When receiving log, processing proceeds to 
processing of STEP S28, to read out of <info> tag in- 
cluded in the log is executed. The <info> tag describes 
log user ID, and log appli. ID. Next, in processing of 
STEP S29, received log is stored into the log storage 
area 6 illustrated in FIG.1. 

[0075] The log storage area 6 is capable of being 
specified by the log user ID as well as the log appli. ID. 
Processing reads out first the log user management ta- 
ble 76 of the log management database 75. Then, iden- 
tification of the log storage table for user 80 is executed 
by using the log user ID. Received log is stored in the 
log storage table for user 80, and, at this time, log re- 
ception ID is obtained. The log reception ID is a number 
for uniquely determining the log. In addition, utilization 
log application management table 77 records the date 
and time of receiving log and the log appli. ID in such a 



way as to match the former with the later. 
[0076] Next, processing reads out log application 
management table 78 of log management database 75. 
Then, identification of log storage table for log applica- 

5 tion by using the log appli. ID. In storage for the table, 
log reception ID, log reception the date and time and log 
user ID are recorded. The log reception ID uses log re- 
ception ID that is obtained when storing log in the log 
storage table for user 80. In addition, also the log recep- 

10 tion the date and time uses the same reception the date 
and time that provided for the user. Log reception 
processing is completed after above described process- 
ing. 

15 Flow of Log Analysis Processing 

[0077] Next, flow of log analysis processing will be ex- 
plained using flowchart illustrated in FIG. 27. Firstly, 
when the log server 7 receives logs, analysis is started 

20 in answer to result that the log is moved to the log stor- 
age area 6. Namely, in processing of STEP S30, 
processing pulls up log list of being registered log on the 
basis of the log appli. ID. Namely, log list registered ac- 
cording to the log appli. ID is pulled up from the log stor- 
es age table for log application 81 of the log storage data- 
base 79 illustrated in FIG. 20. The log list is prepared on 
the basis of the log appli. ID because analysis in every 
analysis unit is executed in every log application unit. 
Next, in processing of STEP S31, the log server 7 as- 

30 certains whether the log list is empty. 

[0078] When log list is empty in STEP S31, since it is 
not possible to execute log analysis of the log applica- 
tion, processing becomes one in which log analysis 
ends, and then processing proceeds to STEP S36, fol- 

35 lowed by conducting processing in which termination 
processing of log analysis is executed. When existing 
log list, processing proceeds to STEP S32, and then 
processing pulls out log from the log list and pulls out 
login interface ID from <DATA> tag. Next, in processing 

40 of STEP S33, processing generates log analysis inter- 
face 70 from login interface ID. This is one in which 
processing asks login interface management unit 69 il- 
lustrated in FIG.1 7 to generate the log analysis interface 
70 with the result that it is possible to generate the log 

45 analysis interface 70. Next, in processing of STEP S34, 
log contained on the inside of <DATA> tag is analyzed 
using the log analysis interface 70 generated in STEP 
S33. As a result, data of necessary items is extracted, 
and then, in processing of STEP S35, result illustrated 

50 in FIG. 24 is stored. Subsequently, processing from 
STEP S31 to STEP S35 is repeated until log list be- 
comes empty. 

Providing Method of Log Analyzed result 

55 

[0079] Next, as for providing method of the case that 
log analyzed result analyzed by the log server 7 is pro- 
vided for log collection service utilizing company that uti- 
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lizes the log analyzed result will be explained using flow- 
chart illustrated in FIG.28. FIG.28 illustrates flow of the 
case that log collection service utilizing companies 9 to 
12 to be log utilization terminal devices require log an- 
alyzed result acquisition to the log server 7. Firstly, in 
processing of STEP S37, login processing of the log col- 
lection service utilizing companies 9 to 12 for the log 
server 7 is executed. Namely, the log collection service 
utilizing company transmits name of log collection utili- 
zation to the log server 7, namely, transmits licensee 
name and authentication data to the log server 7 via the 
internet 8 illustrated in FIG. 1 . The log server 7 executes 
authentication processing of the log collection service 
utilizing companies by using these information. Then, 
processing of STEP S38 judges authentication result, 
when authentication data is judged as effective data, 
processing proceeds to STEP S39. On the other hand, 
the authentication data is of no effect, judgment that 
login processing is failure is input to the log server 7 and 
then log analyzed result acquisition processing is termi- 
nated. 

[0080] In STEP S38, when the log collection service 
utilizing company succeeds in login, the log collection 
service utilizing company becomes log analyzed result 
acquisition feasible state. In STEP S39, the log collec- 
tion service utilizing company requires log analyzed re- 
sult of being desired to obtain. Namely, the log collection 
service utilizing company specifies login interface ID 
and then transmitting the login interface ID. Thereupon, 
the analyzed result is retrieved in the log server 7 and 
then processing of STEP S40 provides transmission of 
retrieval result for the log collection service utilizing 
company. Then, processing of STEP S41 permits termi- 
nation judgment of the log analyzed result acquisition 
processing. When the log analyzed result is necessary 
yet, processing returns to processing of STEP S39, then 
processing of STEP S39 to STEP S41 are repeated. 
Here, when being judged as acquisition termination, the 
log analyzed result acquisition processing is terminated. 
[0081] In such a way described above, the log collec- 
tion service utilizing company becomes capable of ac- 
quiring desired log collection result. However, login in- 
terface ID which is capable of being specified is limited 
to login interface 38 established by the log collection 
service utilizing company, when another login interface 
38 is specified, no analyzed result is returned. 
[0082] Next, as for processing at the side of the log 
server 7 of this log analyzed result acquisition process- 
ing will be explained referring to flowchart illustrated in 
FIG. 29. Firstly, the log server 7 executes processing of 
login requirement from the log collection service utilizing 
companies 9 to 12. Namely, the log server 7 acquires 
licensee name and authentication data. Next, in 
processing of STEP S43, the log server 7 pulls out au- 
thentication data corresponding to licensee name from 
the log application management table 78 illustrated in 
FIG.1 8. Then, in processing of STEP S44, the log server 
7 judges whether login is effective or of no effective on 



the basis of authentication data stored therein and au- 
thentication data from the log collection service utilizing 
company. 

[0083] When being judged as effective authentication 
5 data, provision processing of the log analyzed result is 
started. Namely, in processing of STEP S46, log server 
7 acquires corresponding log analyzed result manage- 
ment table 83 to received licensee name from the log 
application management table 78 illustrated in FIG. 1 9C. 
10 Then, in processing of STEP S47, the log server 7 re- 
ceives login interface ID transmitted from the log collec- 
tion service utilizing company. Next, in processing of 
STEP S48, the log server 7 reads out analyzed result 
from both received login interface ID and log analyzed 
15 result management table. Then, the log server 7 trans- 
mits read out result at processing of next STEP S49 to 
the log collection service utilizing company. 
[0084] In processing of STEP S50, the log server 7 
judges whether read out processing of analyzed result 
20 is terminated by the log collection service utilizing com- 
pany. The log server 7 judges that read out processing 
of analyzed result is not terminated in this STEP S50, 
processing returns to processing of STEP S47, and then 
read out processing of log analyzed result repeated 
25 again. When terminating the processing, the log server 
7 executes log analyzed result acquisition termination 
processing. In addition, in processing of STEP S44, 
when the log server 7 judges that login is of no effect, 
the log server 7 informs the log collection service utiliz- 
30 ing company that login results in failure at STEP S45, 
and then log analyzed result acquisition processing at 
the side of the log server 7 is terminated. 
[0085] As described above, in the present embodi- 
ment, log collecting/analyzing system is constituted in 
35 which log collection terminal devices 1 to 4 collect logs 
to generate desired log information, and then the log in- 
formation is transmitted to the log server 7, and then the 
log server 7 analyzes received log information, then the 
log collection service utilizing companies 9 to 12 receive 
40 the analyzed result. 

[0086] It should be noted that, above-described em- 
bodiment, as illustrated in FIG. 8, it causes the login in- 
terface 38 to be designed and mounted within applica- 
tion 32 which utilizes basic function, however, prefera- 
45 bly, it causes the login interface 38 to be separately de- 
signed from the application 32 and it causes the login 
interface 38 to be mounted with independent condition 
from the application 32. Specifically, as illustrated in 
FIG.30, login interface management unit 34 of log sys- 
50 tern basic function processing unit 33 manages login in- 
terface 38 prepared independently from the above de- 
scribed application 32 and then the application 32 calls 
the login interface 38, then the login interface 38 gener- 
ates log information. 
55 [0087] In addition, in the log collection service utilizing 
company, it is preferable that hardware for acquiring log 
analyzed result possesses the same function as that of 
log collection terminal devices 1 to 4 as illustrated in FIG. 
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2 or it is preferable that hardware for acquiring log ana- 
lyzed result possesses configuration of server type as 
illustrated in FIG. 1 6. Then, as for display of acquired an- 
alyzed result, there is no particular limitation, thus it is 
possible to use freely. Log analyzed result is defined be- 
forehand with specified form in accordance with log col- 
lection service utilizing company. 
[0088] According to the present invention, function of 
log collecting/analyzing system is divided into two func- 
tions in which a function is one for collecting log infor- 
mation, and the other function is one for analyzing col- 
lected log information, further, the function for collecting 
log information belongs to client terminal device, while 
the function for analyzing the collected log information 
belongs to log server, whereby it becomes possible to 
specifically define log collection function, thus it is pos- 
sible to collect more detailed log. For instance, in the 
case of game and so forth, what-like play mode is pop- 
ular, or in the case of game of selecting character, what- 
like character is popular, that are useful information for 
design of the game. The useful information can be ob- 
tained by the present invention. Forthat reason, it is pos- 
sible to make use of result of log analysis for develop- 
ment of the game while performing feedback of result of 
log analysis. 

[0089] In addition, according to the present invention, 
which more minutely manages log user information and 
then connecting the log user information with log ana- 
lyzed result, whereby it is possible to obtain compound 
analyzed result such that the game is popular by which 
layer of age and/or the game is popular by which sex. It 
is possible to record behavior of the user at the applica- 
tion on the basis of such analyzed result. Namely, it be- 
comes possible to dynamically change function that per- 
mits development of the game to be changed according 
to analyzed result. In addition, when the user is puzzled 
how to use application from behavior of the user, it be- 
comes possible to supply more effective hint to the 
game user from collected logs. 

[0090] In addition, according to the present invention, 
since it is possible to independently define login inter- 
face for the sake of log collection, mounting of login in- 
terface capable of reuse becomes possible according 
to form of log. For instance, it is one in which user's taste 
is collected, and so forth. By this effect, login interface 
in relation to certain application is capable of being re- 
placed with the same login interface, accordingly, the 
same login interface is capable of being utilized at the 
application, thus it becomes possible to improve devel- 
opment efficiency for the sake of log collection. 



mitting means for transmitting collected log in- 
formation via network; and 
a log server having storing/analyzing means for 
storing and analyzing the log information trans- 
5 mitted from the client terminal device. 

2. A log collecting/analyzing system according to 
claim 1, wherein the client terminal device further 
comprises forming means for forming basic struc- 

10 ture of log and generating means for generating de- 
sired log information from the basic structure of log. 

3. A log collecting/analyzing system according to 
claim 2, wherein the forming means form tree struc- 

15 ture consisting of nodes and elements as the basic 
structure of log, and the generating means hierar- 
chically generate the log information utilizing the 
tree structure. 

20 4. A log collecting/analyzing system according to 
claim 1, 2, or 3, wherein the client terminal device 
manages the collected log information independ- 
ently for every individual application program. 

25 5. A log collecting/analyzing system according to 
claim 1,2,3, or 4, wherein the client terminal device 
stores the log information under off-line condition 
except for log information transmission processing 
for the log server. 

30 

6. A log collecting/analyzing system according to 
claim 1 , 2, 3, 4, or 5, wherein the client terminal de- 
vice stores the collected log information with de- 
sired form. 

35 

7. A log collecting/analyzing system according to 
claim 1 , 2, 3, 4, 5, or 6, wherein the storing/analyz- 
ing means pulls out necessary information from the 
log information transmitted from the client terminal 

40 device to analyze. 

8. A log collecting/analyzing system according to 
claim 1, 2, 3, 4, 5, 6, or 7, wherein the log server 
manages the log information transmitted from the 

45 client terminal device independently for every indi- 
vidual application program. 

9. A log collecting/analyzing system according to 
claim 1,2,3, 4, 5, 6, 7, or 8, wherein the log server 

50 stores the log information transmitted from the client 
terminal device with desired form. 



Claims 10. A log collecting/analyzing system according to 

claim 1,2,3, 4, 5, 6, 7, 8, or 9, wherein the log server 
1. A log collecting/analyzing system comprising: 55 and the client terminal device manage at least one 

of duration of service or the number of collection 
a client terminal device having collecting times for log collection, 

means for collecting log information and trans- 
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11. A log collecting/analyzing system according to 
claim 1 , 2, 3, 4, 5, 6, 7, 8, 9, or 1 0, further compris- 
ing: 

a log utilization terminal device for requiring de- 
sired log analyzed result analyzed at the log 
server to the log server via network and for re- 
ceiving the log analyzed result transmitted from 
the log server. 

12. A method of log collection comprising the steps of: 

determining whether a log collecting/analyzing 
system can be utilized; 

executing application program that utilizes the 
log collecting/analyzing system in case that the 
log collecting/analyzing system can be utilized; 
collecting log generated by the log collecting/ 
analyzing system at the time of execution of the 
application program; and 
managing information on the log independently 
for every application program. 

13. A method of log collection according to claim 12, 
wherein the managing step further comprises the 
step of managing the information on the log using 
tree structure consisting of nodes and elements. 

14. A method of log collection according to claim 12 or 
13, further comprising the steps of: 

transmitting un-transmitted log to log server via 
network when determining that the log collect- 
ing/analyzing system can be utilized; 
accumulating the un-transmitted log when the 
network is incapable of being connected; and 
transmitting the accumulated un-transmitted 
log to the log server when the network is capa- 
ble of being connected. 

15. A log collection computer program product compris- 
ing computer program means adapted to perform 
the method steps as defined in anyone of claims 1 2 
to 14 when being executed on a computer, digital 
signal processor, or the like. 

16. A method of log analysis comprising the steps of: 



analyzing the log information for every applica- 
tion program utilizing a database which is pro- 
vided with a log management database for 
managing at least from which log application 
5 program the log user utilizes log information, a 

log storage database for managing log informa- 
tion registered in a log application program and 
a log analyzed result management database 
for managing analyzed log information. 

10 

18. A log analysis computer program product compris- 
ing computer program means adapted to perform 
the method steps as defined in anyone of claims 1 6 
and 1 7 when being executed on a computer, digital 

15 signal processor, or the like. 

19. A log collecting device comprising: 

an operating system for operating log collect- 
20 ing/analyzing system; 

an application program that utilizes the log col- 
lecting/analyzing system; and 
a log system basic function processing unit for 
providing basic function of the log collecting/an- 
25 alyzing system, 

wherein the log system basic function 
processing unit includes a log interface manage- 
ment unit for managing log interface for generating 
30 log information at the time of execution of applica- 
tion program, a log object processing unit for con- 
trolling function of log object consisting of log man- 
agement information and log data, a log object 
transmission unit for controlling processing for 
35 transmitting log information to log server and a log 
object management unit for managing log object. 

20. A log collecting device according to claim 19, 
wherein the log object consists of the log manage- 

40 ment information having a log application ID spec- 
ifying application program that utilizes the log col- 
lecting/analyzing system and a log user ID indicat- 
ing that log belongs to which user, and log data con- 
stituting tree structure consisting of nodes and ele- 

45 ments. 

21. A log analyzing device comprising: 

an operating system for operating log analyzing 
system; and 

a log server function processing unit for analyz- 
ing received log information and storing ana- 
lyzed result, 

wherein the log server function processing 
unit includes a log analysis interface management 
unit for managing log analysis interface, a log object 
analysis unit for analyzing the received log informa- 



receiving log information transmitted from log 
collection terminal device via network; 50 
storing received log information; 
analyzing stored log information utilizing log 
analysis interface; and 
storing analyzed result. 

55 

17. A method of log analysis according to claim 1 6, fur- 
ther comprising the steps of: 
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tion, a log object reception unit for controlling func- 
tion for receiving log information transmitted from 
log collection terminal device via network and a log 
analyzed result management unit for storing ana- 
lyzed result. 5 



means for managing at least one of duration of 
service of the log collection and the number of 
collection times about log collection. 

30. A log server comprising: 



22. A log analyzing device according to claim 21 , further 
comprising: 

a log management database for managing at 
least from which application program the log 
user utilizes log information; 
a log storage database for managing log infor- 
mation registered in the application program; 
and 

a log analyzed result management database 
for managing analyzed log information. 



receiving means for receiving log information 
transmitted from log collection terminal device; 
and 

10 storing and analyzing means for storing re- 

ceived log information and pulling out neces- 
sary information from the log information to an- 
alyze. 

15 31. A log server according to claim 30, wherein the re- 
ceived log information is independently managed 
for every individual application program. 



23. A log collection terminal device comprising: 

collecting means for collecting log information; 
and 

transmitting means for transmitting collected 
log information to log server via network. 

24. A log collection terminal device according to claim 

23, further comprising: 

forming means for forming basic structure of 
log; and 

generating means for generating desired log in- 
formation from the basic structure of log. 

25. A log collection terminal device according to claim 

24, wherein the forming means form tree structure 
consisting of nodes and elements as the basic 
structure of log, and the generating means hierar- 
chically generate the log information utilizing the 
tree structure. 

26. A log collection terminal device according to claim 
23, 24, or 25, wherein the collected log information 
is managed independently for every individual ap- 
plication program. 

27. A log collection terminal device according to claim 
23, 24, 25, or 26, wherein the log information is 
maintained under off-line condition except for log in- 
formation transmission processing for the log serv- 
er. 



32. A log server according to claim 30 or 31, wherein 
20 the received log information is stored with desired 

form. 

33. The log server according to claim 30, 31 , or 32, fur- 
ther comprising: 

25 

means for managing at least one of duration of 
service of the log collection and the number of 
collection time about log collection. 

30 34. The log server according to claim 30, 31 , 32, or 33, 
further comprising: 

transmitting means for transmitting analyzed 
result to log utilizing terminal device. 

35 

35. A log collecting/analyzing system comprising: 



a client terminal device having collecting unit 
for collecting log information and transmitting 
40 unit for transmitting collected log information to 

log server via network; and 
a log server having storing/analyzing unit for 
storing and analyzing the log information trans- 
mitted from the client terminal device. 

45 



28. A log collection terminal device according to claim 
23, 24, 25, 26, or 27, wherein the collected log in- 
formation is maintained with desired form. 

29. A log collection terminal device according to claim 
23, 24, 25, 26, 27, or 28, further comprising: 
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FIG. 12 



<PlayMode> 

<playDate>2000, 12, 24</p I ayDate> 
<mode> 

<name>Pract i ceMode</name> 

<se I ectedT i mes>3</se I ectedT i mes> 

</mode> 

<mode> 

<name>TournamentMode</name> 

<se I ectedT i mes>5</se I ectedT i mes> 

</mode> 

<mode> 
<name>SeasonMode</name> 
<se I ectedT i mes>7</se I ectedT i mes> 

</mode> 

<mode> 

<name>Custom i seMode</name> 
<se I ectedT i mes>1 0</se I ectedT i mes> 
</mode> 
</PlayMode> 
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FIG. 13 

<?xml version="1.0" encod i ng="Sh i f t-J I S"?> 

< Log> . 

<lnfo> 

<ApplD>L0G APPLICATION ID</ApplD> 

<UserlD>LOG USER ID</UserlD> 

</lnfo> . 

<DATA interface I D=" INTERFACE 1 Dl"> ~ 

LOG RECORDED BY INTERFACE ID1- 

</DATA> 

<DATA interface I D=" INTERFACE ID2"> 

LOG RECORDED BY INTERFACE ID2- 
</DATA> 
</Log> 



FIG. 14 

SetPlayDater2000, 12.24") ; —53 
SetSelectedModeCSeasonMode") ; —54 
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